SHOREWALL-EXCLUSION(5)

🌸 NAME 🌸

Okay so this is SHOREWALL-EXCLUSION(5), straight outta the Configuration Files manual, and it's about one thing and one thing only: exclusion 💅 — like, how to exclude a whole set of hosts from a definition in a shorewall configuration file. Slay, honestly.

---

✨ SYNOPSIS ✨

!address-or-range[,address-or-range]...

!zone-name[,zone-name]...

---

💖 DESCRIPTION 💖

So, form one is the one you reach for when you wanna exclude one or more addresses from a definition. You slap a ! (exclamation point, iconic) at the front, and then a comma-separated list of addresses right after it. 🎀

The addresses can be:

• single host addresses, like 192.168.1.4
• network addresses in CIDR format, like 192.168.1.0/24

And if your kernel and iptables come with iprange support, you can also specify ranges of ip addresses in the form lowaddress-highaddress — so like 192.168.1.3-192.168.1.12. 🦋

No embedded white-space is allowed. 🚫 Like, none. Not even one. Don't do it.

Exclusion can also show up after a list of addresses and/or address ranges. When it does, the final list of address is formed by taking the first list and then removing the addresses defined in the exclusion. So it's giving "start with everything, then subtract". ✨

Beginning in Shorewall 4.4.13, form two of exclusion is allowed after all and any in the SOURCE and DEST columns of shorewall-rules[1](5). It lets you omit arbitrary zones from the list that those key words generate. So useful. Obsessed. 😌

Warning ⚠️ If you omit a sub-zone and there is an explicit or explicit CONTINUE policy, a connection to/from that zone can still be matched by the rule generated for a parent zone. Yeah, that's the whole point of the warning — read it twice bestie.

For example: 💀

/etc/shorewall/zones:

#ZONE          TYPE
z1             ip
z2:z1          ip
...

/etc/shorewall/policy:

#SOURCE         DEST          POLICY
z1              net           CONTINUE
z2              net           REJECT

/etc/shorewall/rules:

#ACTION         SOURCE        DEST        PROTO         DPORT
ACCEPT          all!z2        net         tcp           22

In this case, SSH connections from z2 to net will be accepted by the generated z1 to net ACCEPT rule. 🫶

In most contexts, ipset names can be used as an address-or-range. Beginning with Shorewall 4.4.14, ipset lists enclosed in +[...] may also be included (see shorewall-ipsets[2] (5)). 🌈 The semantics of these lists when used in an exclusion go like this:

• !+[set1,set2,...setN] produces a packet match if the packet does not match at least one of the sets. In other words, it is like NOT match set1 OR NOT match set2 ... OR NOT match setN.
• +[!set1,!set2,...!setN] produces a packet match if the packet does not match any of the sets. In other words, it is like NOT match set1 AND NOT match set2 ... AND NOT match setN.

---

🎀 EXAMPLES 🎀

IPv4 Example 1 - All IPv4 addresses except 192.168.3.4

!192.168.3.4

IPv4 Example 2 - All IPv4 addresses except the network 192.168.1.0/24 and the host 10.2.3.4

!192.168.1.0/24,10.1.3.4

IPv4 Example 3 - All IPv4 addresses except the range 192.168.1.3-192.168.1.12 and the network 10.0.0.0/8

!192.168.1.3-192.168.1.12,10.0.0.0/8

IPv4 Example 4 - The network 192.168.1.0/24 except hosts 192.168.1.3 and 192.168.1.9

192.168.1.0/24!192.168.1.3,192.168.1.9

Example 5 - All parent zones except loc

any!loc

---

🦋 FILES 🦋

• /etc/shorewall/hosts
• /etc/shorewall/masq
• /etc/shorewall/rules
• /etc/shorewall/tcrules

---

💜 SEE ALSO 💜

shorewall(8)

---

🌟 NOTES 🌟

1. shorewall-rules https://shorewall.org/manpages/shorewall-rules.html
2. shorewall-ipsets https://shorewall.org/manpages/shorewall-ipsets.html

---

And that's the whole page, bestie 🫶 this was SHOREWALL-EXCLUSION(5) from the Configuration Files manual, dated 09/24/2020. Go exclude something (responsibly) 💅✨